Staff Product Security Engineer

Lead threat modelling and security reviews across UpGuard's product portfolio and cloud infrastructure, proactively surfacing attack vectors and designing mitigation strategies that scale with growth.

Build automation, policy-as-code, and AI-driven security tooling that lets product engineering teams "shift left" and embeds security across the SDLC, leveraging agentic workflows to triage, review, and scale the reach of a lean security function.

Design and implement secure-by-default configurations for cloud and Kubernetes infrastructure.

Own vulnerability management end-to-end, triaging and prioritizing by real risk, driving remediation with engineering teams, and building preventative controls across the software supply chain from development through production.

Build scalable detection and response systems that catch malicious activity, triage the noise, and run incidents end to end.

Build deep partnerships with our product engineering and platform teams, helping them deliver secure-by-design solutions.

You'll be building a function, not inheriting one; with real executive backing, at a company where product security is core to the business rather than a cost centre. Our engineering culture values iteration, collaboration, and speed, with a no-ego approach and pragmatic trade-offs. We're fully remote with optional offices in Sydney and Hobart, and no mandatory office attendance.

7+ years of experience in security engineering and/or software engineering/or security operations, work in cloud environments, with a focus on the below:

Cloud security experience (GCP preferred, but AWS or Azure is welcome)

Cloud native Kubernetes services (EKS/GKE/AKS) and strong container security principles

Strong understanding of securing IAM and cloud identities

Experience leading technical security reviews of products and architectures, running threat modelling exercises, and turning findings into security controls engineering teams can implement.

Strong knowledge of common web application vulnerabilities and how to prevent them (OWASP Top 10 and similar).

Hands-on experience with IAC and related tools (preferably Terraform/OpenTofu)

Experience as the first security hire or founding member of a security function at a scaling company.

Familiarity with AI/LLM security risks (e.g. OWASP LLM Top 10) and securing AI-powered product features.

Strong backend engineering skills, particularly in Go

Experience supporting SOC 2 / ISO 27001 audits from an engineering perspective.

Public security research, CVEs, open-source security tooling, or conference talks.

Offensive security skills, with the ability to validate findings through hands-on exploitation.

WFH set-up allowance: To ensure you have the right environment to work in, we will help you get set up within your first 3 months at UpGuard

Monthly Lifestyle subsidy: Use this for financial, physical, and mental well-being

$1500 USD annual Learning & Development allowance: To support your career development, all team members will be able to expense development opportunities against this allowance

Annual leave: PTO plus two additional UpGuardian leave days to give you time to recharge your batteries.

18 weeks paid Parental Leave: Irrespective of parenting role

Personal Leave Allowance: This includes sick & carer’s leave

Fully remote working environment: While we have physical offices in Sydney & Hobart, we do not mandate compulsory attendance

Top-spec hardware: All team members will be provided with top-spec laptops for their role

Generative AI subsidy: UpGuard provides paid subscriptions for all team members to access generative AI tools to support their work.

Stock options: Share in UpGuard's growth and long-term success

UpGuard is a Certified Great Place to Work® in the US, Australia, UK and India, establishing its position as a leading global technology employer. 99% of team members agree that UpGuard is a great place to work! Apply now to find out why!

As an Equal Employment Opportunity and Affirmative Action Employer, qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender perception or identity, national origin, age, marital status, protected veteran status, or disability status.

Please Note: Not all roles can be performed from the United States. Please check your specific job listing to confirm its advertised location. If the role you are applying for is listed as based in the US, we are currently only able to support hiring in the following locations: CA, CO, FL, IL, LA, MA, MD, MO, OR, PA, TX, WA, and DC.

Before starting work with us, you will need to undertake a national police history check and reference checks. Also, please note that at this time, we cannot support candidates requiring visa sponsorship or relocation.